How to sandbox AI-generated code with default-deny networking
Kiwi's isolation model rests on one decision: only the test command runs in the sandbox. The LLM Actor and Critic run in the daemon process, outside the sandbox.
Why only the test runs sandboxed
The code the model generates is untrusted. It gets applied to files in a git worktree, and then the test command — the only thing that executes model-influenced code — runs inside the sandbox with default-deny networking. Two properties fall out of this:
- The model-generated code never sees the LLM key. The Anthropic/Codex/Gemini key lives in the daemon process, which calls the provider directly. The sandbox that runs the test has no access to it.
- The sandbox needs no outbound network. Building and running a test doesn't require the internet, so egress is denied by default. Generated code that tries to exfiltrate data or call home has nowhere to go.
This is why Kiwi describes its differentiation as the layer above the sandbox — the planner and the swarm — rather than the sandbox itself. The sandbox is a well-scoped, minimal-trust execution surface.
The drivers
The sandbox driver is pluggable (pkg/sandbox), selected per daemon. Kiwi ships three:
| Driver | Selected by | Use |
|---|---|---|
| Docker | default | Development and BYOC — the test runs in a container. |
gVisor (runsc) | -sandbox-runtime runsc / KIWI_SANDBOX_RUNTIME=runsc | The shared Free tier. runsc is a user-space kernel that intercepts syscalls, giving stronger isolation between co-tenant workloads on a shared host. |
| Firecracker | KIWI_SANDBOX=firecracker | A microVM driver for hardened managed execution. |
:::note Status The Docker and gVisor drivers are on the live path — Docker for dev/BYOC, gVisor for the deployed Free tier. The Firecracker microVM driver for the managed-dedicated path is built but not yet deployed or hardware-validated. Check the status table for the current state. :::
Resource bounds
Beyond isolation, the test run is bounded so a single task cannot monopolize a host:
- A wall-clock timeout per task, from the org's
TaskTimeoutSecondslimit. - A sandbox disk ceiling (
MaxSandboxDiskMB). - The daemon-level loop caps — max-steps and max-budget — bound how many times the sandbox is invoked per task (see the Actor–Critic loop).
On the shared Free tier, the free-fleet host runs each daemon's test sandbox as a sibling container under runsc, and hardened multi-tenant egress isolation (default-deny on the free-fleet host) is an in-progress hardening step.